Homebrew Question Mod making: how do I snoop data passed to a function?

[taikodojo]

I am looking at a disassembled NSO for a game I'd like to make mods for, using IDA + the loader found here SwitchIDAProLoader , and there's a specific SDK function that, when called, I want to know all values passed to it while the game is running. Does anyone know how to accomplish this?

Simply finding the address in memory will not help, I want to see values of arguments on the stack as the function is called, also the stack pointer or other useful clues. So I thought of using edizon or cheat engine, but I'm not sure I can accomplish what I want with that. Any ideas? I'm new to switch, how do you snoop data while running?

 

[masagrator]

If this function has symbol, you can use SaltyNX to mitm a function and pass values to separate variables, then read them with any cheat engine/svc (noexs for example). This is only thing that came to my mind. Only issue is that SaltyNX is not compatible with all games.

You can check NX-FPS as an example. At game boot it's generating .hex file where is stored offset to variable in RAM - because ASLR.

Otherwise I don't think you can do anything within Horizon with official games using existing tools I am aware of.

There are also two things that may be helpful, but I have never used them with SaltyNX:
- svcOutputDebugString
- function that passes info to LogManager. Its reimplementation is currently wip by XorTroll.

And if you would share what function you want to check, maybe I can provide some info I have extracted from few .nss files.

To get full access you would either inject your own debugger with modified npdm (with layeredfs) and nacp (only by repacking game) to get full permissions or wait for hypervisor reimplementation (which is worked on by original SaltyNX author).

 

[taikodojo]

Thanks for that thorough reply, that will give me tons to work with, read up on, and learn about. I will keep you updated on progress!